PT-2023-6527 · Mozilla+5 · Firefox+5
Shaheen Fazim
·
Publicado
2023-10-24
·
Atualizado
2025-03-14
·
CVE-2023-5729
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 119
Description
A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt, potentially obscuring the fullscreen notification and allowing for spoofing attacks. The vulnerability is related to errors in the representation of information in the user interface. It could be leveraged by a remote attacker to conduct spoofing attacks.
Recommendations
For versions prior to 119, update to Firefox version 119 or later to resolve the issue. As a temporary workaround, consider disabling WebAuthn prompts when entering fullscreen mode to minimize the risk of exploitation. Restrict access to fullscreen mode for untrusted websites to reduce the attack surface.
Correção
UI Misrepresentation of Critical Information
Clickjacking
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Firefox
Linuxmint
Suse
Ubuntu